CVE-2016-9841: Apple iPhone OS

Critical severity, CVSS 9.8. EPSS: 7.6% chance of exploitation in the next 30 days.

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Affected products

Apple iPhone OS: before 11 (fixed in 11)
Apple Mac OS X: from 10.0.0, before 10.13.0 (fixed in 10.13.0)
Apple tvOS: before 11.0 (fixed in 11.0)
Apple watchOS: before 4 (fixed in 4)
Canonical Ubuntu Linux: version 16.04 only; version 18.04 only
Debian Debian Linux: version 8.0 only
Netapp Active Iq Unified Manager: from 7.3; from 9.5
Netapp Cloud Backup: affected versions not specified
Netapp E-Series Santricity Management: affected versions not specified
Netapp E-Series Santricity OS Controller: from 11.0.0, up to and including 11.70.1
Netapp E-Series Santricity Storage Manager: affected versions not specified
Netapp E-Series Santricity Web Services: affected versions not specified
Netapp Hci Storage Node: affected versions not specified
Netapp Oncommand Balance: affected versions not specified
Netapp Oncommand Insight: affected versions not specified
Netapp Oncommand Performance Manager: affected versions not specified
Netapp Oncommand Shift: affected versions not specified
Netapp Oncommand Unified Manager: up to and including 7.1; affected versions not specified
Netapp Oncommand Workflow Automation: affected versions not specified
Netapp Snapmanager: affected versions not specified
Netapp Solidfire: affected versions not specified
Netapp Steelstore Cloud Integrated Storage: affected versions not specified
Netapp Storage Replication Adapter For Clustered Data Ontap: affected versions not specified
Netapp Symantec Netbackup: affected versions not specified
Netapp Vasa Provider For Clustered Data Ontap: from 7.2
and 14 more

Published 2017-05-23. Last modified 2026-10-08.